feat: sync default component images from upstream Supabase - #16
Conversation
Consolidate default image constants into api/v1alpha1 as single source of truth. Webhook defaults and kubebuilder markers were already out of sync (gotrue v2.180.0 vs v2.177.0). CRD schema defaults apply before the mutating webhook, so the stale marker values silently won. Add hack/sync-upstream-images.sh and a weekly workflow that pulls versions from upstream docker-compose.yml and opens a PR gated by the existing e2e suite.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 92cfaf4f2d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if [ "$old_image" = "$new_image" ]; then | ||
| echo " = ${service}: ${old_image} (up to date)" | ||
| continue |
There was a problem hiding this comment.
When a constant already matches the upstream compose image, this branch skips update_marker, so a stale kubebuilder default marker/CRD can remain stale and the script will still report the service as up to date. That recreates the drift this change is meant to prevent: for resources where Kubernetes applies the CRD default before the webhook, users continue to get the marker value rather than the constant. Consider checking and updating the marker independently of whether the Go constant changed.
Useful? React with 👍 / 👎.
1 participant
Problem
Default component image versions live in two places, the webhook constants and the kubebuilder CRD markers, and they have drifted apart. CRD schema defaults apply before the mutating webhook, so the stale marker values are what actually take effect. There is also no process for following upstream Supabase version updates.
Solution
Consolidate image defaults into api/v1alpha1 as the single source of truth, and add a weekly GitHub Actions job that syncs versions from the upstream docker compose file and opens a PR gated by the existing e2e suite.
Major Changes
api/v1alpha1/wellknown_images.goholds all default image constants; webhook and component builders reference it, removing theinternal/componentdependency oninternal/webhookhack/sync-upstream-images.shparses the upstream compose file and rewrites both the constants and the markers; the db service is intentionally excluded since the operator requires user provided PostgreSQL.github/workflows/sync-upstream-images.yamlruns weekly, regenerates CRDs, runsmake test, and opens a PR via peter-evans/create-pull-requestNote: configure a
SYNC_UPSTREAM_TOKENPAT secret so CI triggers on the auto created PRs; the default GITHUB_TOKEN cannot trigger other workflows. The first auto PR will propose large jumps (Kong 2.8 to 3.9 among others), which is exactly what the e2e gate is for.